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Electronic Control System for a Vehicle and Method for 
Determining at Least one Driver- Independent Intervention in a 
Vehicle System 



The present invention relates to an electronic control system 
for a vehicle and a method for determining at least one 
driver- independent intervention in a vehicle system. The 
invention particularly relates to a method for avoiding 
accidents and injuries by the integration of the active and 
passive safety means and the active driving dynamics control 
in an electronic control system of a vehicle. 



1. State of the Art 

In the past, passive safety systems for avoiding any injuries 
induced by accidents have mainly been developed separately and 
independently of active safety systems for avoiding accidents. 

The first major improvements of passive safety in the middle 
of the sixties implying the safety passenger cell, the three- 
point seat belt, up to the later development of the 
deformation zone, did not yet represent a break-through in the 
improvement of active safety. It was only with the wide 
spreading of ABS at the beginning of the eighties that the 
foundation for active electronic safety systems was formed. 



- 2 - 



Since then, electronically controlled systems such as ESP 
driving dynamics control systems, ACC, seat-belt tensioning 
devices, and airbags are being employed for active and passive 
safety. 

The entire potential of the individual systems is, however, 
fully utilized only if the systems are interconnected in a 
network and data about the driving condition, the vehicle's 
ambience and the driver himself is available to all 
subsystems. The idea of a network has been realized in a first 
step in the project Reduced Stopping Distance ('Reduced 
Stopping Distance RSD, title '30m car'. Continental group of 
companies, December 2000) in the field of active safety 
systems. A specific brake tire serves as the basis for 
shortening the stopping distance, which, due to its bionomical 
structure, will not only increase its wheel contact area when 
a brake force is applied but also ensure a homogeneous 
distribution of the forces in the tire contact area. This fact 
increases the maximum possible deceleration to roughly 1.3 g 
with optimal road conditions . To be able to transmit this high 
brake torque onto the road in the case of an emergency 
braking, intervention in the shock absorbers is necessary to 
dampen the pitch oscillation induced by the impact of braking 
in the direction of aperiodicity . This provides the ABS with 
better control conditions and renders it more efficient. The 
average transmissible brake torque is increased by the 
minimized wheel load fluctuations. In particular when a wheel 
encounters slip at the beginning of the emergency braking 
operation, the network connection between the adjustable 
dampers and the ABS control allows adjusting the optimum of 
wheel slip with a higher rate of accuracy. 
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The entire stopping maneuver is furthermore shortened by the 
quicker pressure increase that is possible due to the use of 
an electrohydraulic brake system (EHB) . In this arrangement, 
the application of the brake pedal is analyzed, and the 
pressure out of a pressure accumulator is fed into the brake 
system assisted by a brake assist system (BA) . This allows 
reducing the threshold time and, thus, shortening the travel 
that is covered from the point of time of the first brake 
pedal contact until the full development of the braking power. 

The network connection has been extended in the following 
improvement by integrating ambience data. A 77 GHz radar 
sensor or a LIDAR distance sensor included in the Adaptive 
Cruise Control (ACC) supplies the distance and relative speed 
of the vehicles in front of one's own vehicle. The comfort-- 
oriented ACC control uses this data to permit the driver 
relaxed and non-tiring driving relieved from routine tasks 
(distance-keeping) . 

An activated ACC system, however, also enhances safety for an 
inattentive driver. The ACC system recognizes a dangerous 
situation and initiates an independent braking maneuver at a 
critical distance and a relative speed until the allowed limit 
of 2 to 3 m/s^. If this deceleration is insufficient to avoid a 
collision, the driver is warned by a signal and requested to 
perform a braking maneuver. 

This provision will shorten the travel any inattentive driver 
covers until he has recognized the risk and starts to 
reposition his foot to depress the brake pedal. 
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With the consequent linking of distance sensor and brake 
system, this shortening of the reaction travel can also be 
used when the ACC system is deactivated • When the driver takes 
over to perform the braking maneuver in this dangerous 
situation, the extended brake assist system (BA+) will support 
the driver in the further brake pressure buildup. 

DE 198 06 687 Al discloses a method for preventing a collision 
of a vehicle with an object positioned in front of the 
vehicle. In this arrangement, the distance and the relative 
speed between the vehicle and obstacle and the speed and the 
acceleration or deceleration of the vehicle are detected, and 
collision indications or braking operations are initiated 
depending thereon. As this occurs, a braking operation shall 
only be initiated when the sensed distance is shorter than two 
calculated distances. One calculated distance represents a 
minimum distance which allows avoiding a collision at a 
maximum deceleration, while the other distance is meant to 
allow directing the vehicle past the object. 

Further, WO 03/006289 discloses a method for the automatic 
activation of a deceleration of a vehicle for preventing a 
collision with another object, wherein depending on radar or 
Lidar signals or video signals, objects in the range of the 
vehicle's course are detected and motional quantities of the 
vehicle are sensed, A risk potential shall be determined 
depending on the object detected and the motional quantities. 
According to this risk potential, the means of deceleration 
shall be operated in at least three conditions. In addition, 
it is envisaged to diminish the consequences of an imminent 
collision with another object by activating passive or active 
restraint systems . 
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2. Description and Advantages of the Invention 

An object of the invention is to provide an electronic control 
system and a method for preventing a collision and/or for 
avoiding the consequences of a collision with an object, which 
method prevents erroneous interventions or faulty control 
activations contrary to the driver's judgment and nevertheless 
supports the driver optimally in dangerous driving situations 
and takes necessary protective measures. 

According to the invention, this object is achieved in that a 
generic electronic control system for a vehicle is configured 
in such a fashion that the control system comprises a driver 
request module for determining characteristic quantities with 
respect to a driver's request from data at least 
representative of pedal travels, movements of the foot 
changing between the pedals, and the brake pressure of the 
brake system, and a risk calculator for determining the risk 
potentials from predefined and current vehicle data and 
additional data, such as ambience data and driver data, and 
optionally data of persons inside and outside the vehicle, and 
similar data, and the risk calculator performs at least one 
assessment of the condition of danger of the vehicle and the 
occupants in the vehicle and, in case of need, of the ambience 
still and, depending on the assessment and on further criteria 
or weightings, outputs controlling interventions graded 
according to the risk potential to an arbitration unit for 
controlling actuators, and said arbitration unit performs an 
assessment with the data determined in the driver request 
module with regard to the driver's request at least depending 
on an action influencing the driving dynamics of the vehicle 
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brought about by the controlling interventions, and, depending 
on the result of the assessment, releases the graded 
controlling interventions to a limited extent, releases or 
blocks them. 

Further, the object is achieved in that a generic method for 
determining at least one driver-independent intervention in a 
vehicle system is performed in such a manner that in a driver 
request module for determining characteristic quantities with 
respect to the driver's request, a driver's request is 
determined from data at least representative of pedal travels, 
movements of the foot changing between the pedals, and the 
brake pressure of the brake system, and risk potentials are 
determined in a risk calculator from predefined and current 
vehicle data and additional data, such as ambience data and 
driver data, and optionally data of persons inside and outside 
the vehicle, and similar data, and the risk calculator 
performs at least one assessment of the condition of danger of 
the vehicle and the occupants in the vehicle and, in case of 
need, of the ambience still and, depending on the assessment 
and on further criteria or weightings, outputs controlling 
interventions graded according to the risk potential to an 
arbitration unit for controlling actuators, and said 
arbitration unit performs an assessment with the data 
determined in the driver request module with regard to the 
driver's request depending on an action influencing the 
driving dynamics of the vehicle brought about by the 
controlling interventions, and depending on the result of the 
assessment, releases the graded controlling interventions to a 
limited extent, releases or blocks them. 
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The control system of the invention and the method of the 
invention, in an actual and/or alleged accident situation, is 
used to determine in a risk calculator risk potentials for 
persons inside and/or outside the vehicle, for the vehicle or 
objects, from data comprising predetermined and current 
vehicle data, ambience data and driver data as well as 
additional data such as data of persons inside and outside the 
vehicle, and similar data. Further, the driver's request is 
determined in a driver request module from pedal travels, 
movements of the foot changing between the pedals, and brake 
pressures of the brake system and further quantities or 
conditions, such as steering angle variations, accelerator 
pedal travels, stop lights on/off, and/or derivatives of the 
previous data and quantities. Basic driver requests may be 
acceleration or deceleration and/or a change of the driving 
direction. From the correlation of the data representative of 
the driver's request and the risk potentials, controlling 
interventions for the actuators of a vehicle being determined 
in the risk calculator are released to a limited extent, 
released or blocked in an arbitration unit. 

The release to a limited extent implies controlling 
interventions of selected actuators, while controlling 
interventions of other actuators which are simultaneously 
output by the risk calculator are blocked or suppressed, 
respectively. 

Due to the estimation or assessment of the risk for persons 
and objects and the correlation of this estimation or 
assessment with the actual request of the driver regarding his 
driving behavior in the estimated or assessed danger 
situation, it is possible to suppress by control technique. 
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modify or proportionately release (e.g. a controlling 
intervention in the brakes of 40 bar is reduced to a brake 
pressure of 20 bar) or release controlling interventions for 
actuators which are produced resulting from current driving 
situations with risk potential. The danger situation is 
estimated by the risk calculator in a Mriver-adaptive' 
fashion so that the controlling interventions are executed, 
blocked or modified depending on the risk potential determined 
and on the driver's request. 

Controlling interventions can only be released depending on 
the risk potential, without being arbitrated with respect to 
the driver's request. In this arrangement, the influence which 
this intervention has on the driving dynamics is one criterion 
for disregarding the driver's request. 

Advantageously, different risk potentials are determined in 
the risk calculator and suitably combined for producing 
controlling interventions, and one risk potential is 
calculated by means of a fuzzy system. The controlling 
interventions are then adapted to the driver's request, what 
is expediently realized in a state machine. To be able to 
comprehensively assess the complex driving situation, risk 
potentials are produced with respect to different ranges of 
application. With regard to the risk potentials, a distinction 
is made between general potentials and special potentials. A 
general risk potential implies actuator-independent potentials 
such as risk potentials from ambience data and vehicle data 
assessing the longitudinal-dynamics criticality of the driving 
situation. 
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A special risk potential implies actuator-related potentials 
such as a risk potential evaluating the driving situation 
based on sensor data, vehicle data, and actuator-related 
characteristic quantities such as activation times. 

The risk calculator, whose input is supplied with 
predetermined vehicle data, ambience data, current vehicle and 
driver data, data of persons inside and outside the vehicle, 
and similar data, performs an assessment of the condition of 
risks of the vehicle and the persons inside and outside the 
vehicle. Depending on the assessment and optional additional 
criteria or weightings, the risk calculator outputs graded 
controlling interventions or actuating signals which control 
actuators changing or triggering the driving performance of 
the vehicle and/or the passenger protection and/or haptic 
and/or optical and/or acoustical risk feedbacks and/or 
additional reversible/non-reversible adjustment actuators 
and/or protection means for other traffic participants 
(pedestrians, cyclists, etc.) in such a way that maximum 
protection is obtained for the persons and the vehicle 
according to a priority control. 

Depending on the determined risk potential and other 
characteristic quantities, the priority control defines how 
the graded controlling interventions are prioritized. 

Favorable improvements are indicated in the sub claims. 

Advantageously, the repositioning movement of the foot from 
the accelerator pedal to the brake pedal is determined from 
information about the accelerator pedal travel and the stop 
light information as input quantities of the driver request 
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module. The time of repositioning the foot from one pedal to 
the other is determined from these two input quantities. 

At least one braking request is determined from the data in 
the driver request module and made available to the subsequent 
arbitration unit. Apart from the braking request, 
appropriately, a steering request and/or an acceleration 
request is determined from additional data in the driver 
j^equest module and sent to the subsequent arbitration unit. 

To determine the risk potential, the risk calculator is 
supplied with input data of vehicle systems, such as ambience 
systems, seat adjustments, safety-belt tensioning systems, 
pedal travel sensors, and/or driving dynamics control systems 
(ESP, ABS, ACC, BA) , and like systems. According to the 
invention, the risk calculator calculates risk potentials from 
data representing at least the vehicle longitudinal speed, the 
vehicle longitudinal acceleration, the vehicle lateral 
acceleration, the distances from relevant objects in the local 
range and/or the remote range and/or their derivatives and 
state data about driving dynamics controllers such as ABS, 
HBA, ESP, and like systems, said risk potentials, at least in 
dependence on determined longitudinal-dynamics and/or lateral- 
dynamics risk characteristic quantities, producing correction 
variables graded in their effect and dependent on the 
determined risk potential for the brakes, the reversible 
occupant protection means and for the adjusting devices that 
change the relative position between occupant protection means 
and vehicle occupants. 

By means of the ambience system, the risk calculator can use 
the information of the distance sensors to purposefully 
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condition the passive safety measures in addition to the 
active safety systems. As this occurs, the non-reversible 
occupant protection means are pre-conditioned, that means, 
additional data is provided by the risk calculator. This 
information can be used to modify activation thresholds. The 
occupants' risk of injury is reduced, and the seriousness and 
frequency of an accident decreases. 

With the development of a pre-crash sensor (Closing Velocity - 
VC) and the integration of the CV function in a radar and/or 
infrared sensor, the time prior to an accident is used to 
include the gravity of an accident to be expected and the 
estimated direction of impact in the intervention strategy of 
the actuators such as the release strategy of the airbags. 
Apart from improving the occupant protection, the CV sensor is 
also used to detect pedestrians. It offers the possibility of 
achieving a protection for pedestrians along with an 
additional plausibilisation by way of low-g acceleration 
sensors (satellites) . 

The safety gained by the electronic control system and the 
method can be achieved by the network connection of the 
components and by the central estimation of the likelihood of 
accidents using the data of the network systems. The control 
system and the method found on the basic idea of the data 
exchange among safety systems having data about the driver, 
the vehicle and the surroundings of the vehicle. It is not 
only an extra value for the driver that is aimed at by way of 
realizing new functions with components already provided, in 
addition, costs are reduced by the network connection of the 
available components. 
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The central and linking part of the software is the risk 
calculator where all pieces of data in the vehicle are 
gathered. The ambience data is fused therein, and all data is 
analyzed. According to a preferred embodiment, the ambience 
data fusion can also take place in a separate module which is 
connected upstream of the risk calculator and provides it with 
fused ambience data as relevant data for a safety system, A 
risk potential mirroring the instantaneous likelihood of an 
accident is determined for the current driving situation. When 
the risk potential rises, measures are gradually taken, 
starting from information and warnings for the driver until 
the activation of reversible restraint • systems . 

Ambience sensors provide a major contribution in this respect. 
They allow the expedient use of reversible measures for the 
passive safety. 

Another step in the direction of gaining greater safety is 
taken by introducing picture-processing camera systems. This 
provision renders it possible for the first time to classify 
the objects in addition to the detection of objects. Combined 
braking and steering interventions will assist the driver in 
the accident prevention. 

The passive safety is enhanced and the risk of injury for the 
vehicle occupants is minimized when the risk calculator 
actuates the electric seat adjustment. Submarining is 
definitely counteracted, while likewise a distance between the 
co-driver and the airbag that is not optimal is corrected. For 
the necessary actuation, the risk calculator procures 
information about the driving situation in the simplest case 
from the control conditions of the installed active safety 
systems such as ESP, BA and Active Rollover Prevention (ARP) . 
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In addition, the risk calculator can generate controller 
outputs for closing openings in the vehicle in order to 
further improve the passive safety depending on the determined 
risk potential. Preferably, the windows and the sliding roof 
are closed when an accident is imminent. With the risk 
potential continuing to rise and a crash being imminent, the 
vehicle occupants are secured and positioned by way of an 
electromotive, reversible seat-belt tensioning device. The 
vehicle occupants participate earlier in the vehicle 
deceleration due to the belt slack being reduced. Also, the 
occupants' risk of injury will further decrease. 

Advantageously, optical and/or haptic warnings and/or 
directions or instructions are provided how to warn and/or 
guide the driver to a reaction that is adapted to the current 
vehicle situation. The warnings are given preferably by means 
of a vibrating pedal and/or seat and/or a display. 

The directions are given by means of a modified control force 
on at least one pedal and/or the steering wheel so that the 
driver is induced by the increasing or decreasing control 
force to steer the vehicle in conformity with the situation. 

The actual functions of the risk calculator are mainly the 

1. calculation of characteristic quantities related to 
driving dynamics 

2. calculation of risk potentials 

3. calculation of the actuating signals (universally valid 
quantity - not the actual actuator driving signal) due 
to the risk potentials. 
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Thus, a level of abstraction is defined which assesses the 
situation in an appropriate manner. This level is realized by 
the risk potentials. The risk potential is a dimensionless 
quantity ranging between 0 and 100. The higher the risk 
potential is, the more dangerous the situation. The actuators 
are driven only due to inquiries of the risk potentials with 
respect to threshold values. Several risk potentials can be 
combined in order to activate an actuator. This means that the 
assessment of the state initially does not comprise the 
selection or proportioning of the actuation of the actuators. 
In this arrangement, a certain situation is assessed by 
several risk potentials. This allows a more comprehensive 
assessment of the situation. There are risk potentials which 
assess the situation irrespective of the actuator means. For 
example, there may be a risk potential assessing the 
longitudinal-dynamics driving condition. Accordingly, there is 
a universally valid risk potential describing the lateral- 
dynamics driving condition. In contrast to these universally 
valid risk potentials, there are special risk potentials 
adjusted to defined actuators. These risk potentials take the 
fact into account that different actuators have different 
activation times. This means that the same situation is 
comparatively more critical for an actuator having a long 
activation time than for an actuator having a short activation 
time. 

Hence, there are universally valid risk potentials and risk 
potentials especially set up for actuators. 

The arbitration unit provided in the electronic control system 
preferably includes a state machine which arbitrates the 
behavior of the driver by way of quantities representing the 
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accelerator pedal travel, the accelerator pedal speed, and the 
time of the foot repositioning between the accelerator pedal 
and the brake pedal and/or the condition (on/off) of the stop 
light and/or measured and/or calculated brake pressures of the 
brake system and/or the vehicle acceleration and/or their 
derivatives in correlation to an actuation quantity depending 
on the risk potentials and releases brake pressure 
specifications of the risk calculator in dependence on the 
result. Depending on the development of the risk potential 
(value and/or gradient), the controlling intervention, such as 
a braking intervention, can also take place autonomously, 
meaning in contrast to the driver's request. The autonomous 
controlling intervention, such as a braking intervention, is 
limited with respect to the value of the controller output, 
such as braking pressure. 

Depending on the condition of the arbitration unit, 
controlling interventions for the deceleration devices of the 
vehicle are then made available which comprise different brake 
pressure requests reaching from prefilling the brake system to 
reduce the response time up to the introduction of maximum 
brake pressure. 

To this end, the state machine assesses the behavior of the 
driver and, depending on the assessment, releases brake 
pressure specifications of the risk calculator. Mainly the 
movement of the driver's foot is assessed. This movement 
allows conclusions as to how dangerous the driver assesses the 
same situation to be or whether he has detected a critical 
situation at all. Only when the driver confirms this critical 
situation will brake pressure be built up irrespective of the 
driver. Four stages are distinguished in this regard: 



1 



) 



- 16 - 



1. not supported: The driver shows his wish to accelerate by 
way of a positive time gradient on the accelerator pedal. 
Even if the risk calculator detects a critical situation, 
brake pressure is not built up autonomously in this 
condition pmax = Obar. 

2. prefill: This level defines a condition where the 
deceleration request of the driver can be defined only 
within limits or does not yet exist. The driver must 
touch the accelerator pedal in this condition. There are 
two subordinated conditions: 

a) prefill 1: The calculated risk potential has a time 
gradient lying above a defined threshold. The driver does 
not change his accelerator pedal position. This situation 
is interpreted as an extreme aggravation of the risk 
situation so that a brake pressure of maximally plmax = 
kl bar is admitted without active actuation of the 
driver. This causes application of the brake pads without 
any remarkable deceleration of the vehicle. 

b) prefill 2: When the driver confirms the critical 
situation by leaving the accelerator pedal (negative time 
gradient on the accelerator pedal), a maximum brake 
pressure of p2max > plmax is allowed. This causes a low 
deceleration of the vehicle of 0.1 to 0.2g. 

3. prebrake: The driver has applied neither the accelerator 
pedal nor the brake pedal in this condition. Therefore, 
this condition is interpreted as a limited deceleration 
request. The maximum deceleration is thus raised to 
roughly the legally admissible level (0.3g) so that a 
maximum brake pressure of p3max > p2max can be achieved. 

4. extended brake assist: With the transition into this 
condition, the driver confirms his deceleration request 
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by applying the brake pedal* If additional conditions are 
fulfilled now, the brake pressure predetermined by the 
risk calculator is released depending on the degree of 
this fulfillment. 
These conditions are as follows: 

An emergency situation is derived from 

a) the time variation of the brake pressure and 
the stop light information and 

b) the time variation of the risk potential. 
When the emergency situation is detected, the brake 
pressure calculated by the risk calculator is totally 
conducted as a nominal value to the brake system. The 
driver receives maximum support. If, however, no emergency 
situation is detected, a characteristic factor is 
determined representative of the degree of the braking 
request of the driver. This factor is composed of three 
components included in a defined weighting ratio: 

a) Ratio of the brake pedal travel to the maximum of the 
brake pedal travel which depends on the pressure in the 
system (represented by the wheel brake pressure) or 
ratio of the brake pressure to the maximum of the brake 
pressure of the brake system. This is necessary because 
the driver senses the brake pressure in the system in 
case the latter system should be prefilled. 

b) Ratio of brake pedal speed to the maximum of the brake 
pedal speed or ratio of brake pressure variation to the 
maximum of the brake pressure variation. This maximum 
is independent of the degree of the system's prefilling 
in approximation. 

c) Factor assessing the time of repositioning the foot 
between the accelerator pedal and the brake pedal. 
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In this condition, the driver is given a brake assist 
adapted to the situation by releasing the brake pressure 
that is determined in the risk calculator. 

The specific configuration depends on the equipment of the 
vehicle. Therefore, the electronic control system and the 
method of operating the control system preferably has a 
modular design so that modules for the active safety 
systems ABS, ESP, TCS, and the like, and the risk 
calculator are able to calculate in parallel and 
separately deceleration requests and additional 
controlling interventions. 



Technical Advantages of the Invention 

Taking into account additional input quantities to 
determine further risk potentials that improve and 
describe the assessment of the risk situation with 
greater precision. 

Extension capability for the additional actuation of new 
actuators by the introduction of new or the use of known 
risk potentials. 

Release of the controlling interventions determined by 
the risk calculator (virtual co-driver) depending on the 
driver's assessment of the situation and/or of additional 
quantities for the assessment of the current traffic 
situation such as vehicle-vehicle communication. Thus, 
faults in the sensors do not have major effects on the 
system behavior or are limited in their consequences. The 
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driver depicts a plausibilisation for the controlling 
interventions demanded by the risk calculator. 



4 . Drawings 

An embodiment of the invention is illustrated in the 
accompanying drawings and will be described in detail in the 
following. 

In the drawings: 

Figure 1 is a state illustration showing the network 



connection of the active and passive vehicle systems 
with the electronic control system of the invention; 



Figure 



2 



is a block diagram of the system structure of the 
electronic control systems- 



Figure 



3 



is a simplified categorized illustration of the 
difference between the nominal distance and actual 
distance from traffic participants; 



Figure 



4 



shows a categorization of the controlling 
interventions (output quantities) by means of 
membership functions (MF: Membership Function, 
Singletons are used in the example) ; 



Figure 



5 



is a schematic view of the control basis for the 
controlling intervention nominal deceleration anomi 
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depending on the nominal distance, actual distance 
and relative speed; 

Figure 6 is a schematic view of the state transitions prefill, 
prebrake, extended brake assist; 

Figure 7 is a schematic view of the state transitions prefill; 

Figure 8 is a schematic view of the activation of a seat-belt 

tensioning device; 

Figure 9 is a schematic view of a sigmoid transition function. 



5. Description of Embodiments 



Figure 1 shows the total system of a vehicle linked to the 
electronic control system 20 in a network. In the control 
system 20, the input signals of the ABS/ESP brake system 11, 
of the ambience sensor system 12, the electric seat adjustment 
13, the seat-belt tensioning device 19, and the resulting 
measured or derived internal and/or external signal quantities 
are used to calculate controlling interventions depending on 
risk potentials in a risk calculator 10 (Figure 2) . The 
determination of controlling interventions for actuators is 
based on the following input quantities of the vehicle units 
linked to the control system 20: 
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1. The vehicle longitudinal speed, vehicle longitudinal 
acceleration, the vehicle lateral acceleration, the 
steering angle, the wheel brake pressure, the brake 
pressure in the tandem master cylinder, the gear 
selector, the ESP additional yaw torque, and the 
status signals of stop light switch, accelerator 
pedal travel and the conditions of the ABS, ESP, HBA 
are determined by means of the ABS/ESP brake system 
11 and supplied to the electronic control system 20. 

2. As far as the ambience sensor system 12 is 
concerned, a remote area sensor furnishes the 
distance from the relevant object, a remote area 
sensor furnishes the relative speed with respect to 
the relevant object, a remote area sensor furnishes 
the relative acceleration to the relevant object, 
and the remote area sensor supplies the status 
signals related to the relevant object, and if 
necessary, information about the type of the 
detected relevant object (e.g. pedestrian, truck, 
and the like) and its condition (stands still, 
moves, and so on), sending the data to the control 
system 20. 

3. The electric seat adjustment 13 sends the status 
signals about the occupation of the driver seat and 
the co-driver seat to the control system* 

4. The control of the seat-belt tensioning devices 14 
sends the status signals about the application of 
the belt buckles of the driver and co-driver seats 
to the control system. 

As can further be seen in Figure 1, the electronic control 
system 20 is additionally linked to the airbag control 15, a 
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haptic accelerator pedal 16, the control of the window lifters 
and the sliding roof 17 and the display 18 of the vehicle. 

Figure 2 shows the structure of the electronic control system 
20, providing a signal conditioning device 21 into which the 
data/signals of vehicle 23, driver 24 and ambience 22 are 
read. The signals are subsequently conditioned so that they 
are available in the respectively correct unit. Besides, a 
sensor fusion of the remote and local area sensor can take 
place so that the following software modules 10, 28 and 29 
will use only the fused sensor signal as a distance, speed and 
acceleration signal. A uniform consistent image of the 
ambience exists. This fused signal consequently represents the 
list of relevant objects (distance, type, relative speed ...) to 
which the risk calculator 10 will react. Further, a module 29 
for detecting the driver's request is connected to the signal 
conditioning device 21. Specific characteristic quantities 
such as the time needed for repositioning the foot between the 
pedals, a deceleration requested by the driver, etc., are 
derived from input quantities which describe the driver' s 
request with respect to steering the vehicle. 

In the risk calculator 10 connected to the signal conditioning 
device 21, the accident likelihood is determined on the basis 
of the input data with the aim of driving the actuators 
provided in the vehicle. 

In a particularly favorable embodiment, the following data can 
be used as input quantities to determine the current risk 
situation (risk potential and direction) : 
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information about the distance of objects (such as 
vehicles, immobile obstacle etc.) in vehicle coordinates 
and in relation to the predicted collision range of the 
own driving trajectory; their relative speeds e.g. by 
means of distance sensors or by means of extension by 
local area sensors, in particular pre-crash sensors 
assessment of the range of vision, e.g. by means of the 
distance sensors 

contact sensors on the vehicle (e.g. glass fiber for 
contact force, acceleration sensors) for detecting e.g. a 
crash with a pedestrian 

classification of the detected objects (pedestrians, 
expansion of the objects, ...) e.g. by means of camera and 
image processing 

information about the course of the road (geometry data, 
curve radii, track width, number of tracks, ...) , 
directional traffic signs and traffic regulation signs 
telematic information (traffic jam information via TMC 
(Traffic Message Channel) or GSM (Global Standard for 
Mobile Communication, road condition information, ...) 
driving dynamics sensors and models for determining the 
vehicle state from wheel speed, yaw rate, longitudinal 
acceleration, lateral acceleration, steering angle, 
steering angle speed, sideslip angle, ESP additional 
torque and/or coefficient of friction) 
actuating conditions of the control devices in the 
vehicle 

sensors for the detection of occupants and classification 
(e.g. OOP, child seat detection, driver's condition such 
as tiredness, ...) 

information about the potential coefficient of friction. 
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5.1 Description of the Function of the Risk Calculator 

The risk calculator 10 mainly executes three process steps. 
These steps are 

1. .calculation of characteristic factors related to 
driving dynamics (time to collision ttc, necessary 
deceleration to avoid a collision, resulting vehicle 
acceleration, speed of the vehicle or object ahead) 

2. calculation of risk potentials 

3. calculation of the drivingf signals (universally valid 
quantity - not the actual actuator driving signal) due 
to the risk potentials. 

In this arrangement, a level of abstraction is defined which 
assesses the situation in an appropriate manner. This level is 
realized by the risk potentials. The risk potential is a 
dimensionless quantity ranging between 0 and 100. The higher 
the risk potential is, the more dangerous the situation. The 
actuators are driven only due to inquiries of the risk 
potentials with respect to threshold values. Several risk 
potentials can be combined in order to activate an actuator. 
This means that the state assessment initially comprises the 
selection or the proportioning of the actuation of the 
actuators only to a limited extent (see special risk 
potentials hereinbelow) or not at all (see universally valid 
risk potentials hereinbelow) . It becomes apparent from the 
above explanations that a defined situation is assessed by 



several risk potentials. This allows a more comprehensive 
assessment of the situation. There are risk potentials which 
assess the situation irrespective of the actuators. For 
example, there may be a risk potential assessing the 
longitudinal-dynamics driving condition. Accordingly, there is 
a universally valid risk potential describing the driving 
condition related to lateral dynamics. 

In contrast to these universally valid risk potentials, there 
are special risk potentials which are set up for defined 
actuators. These risk potentials take the fact into account 
that different actuators have different activation times. This 
means that the same situation is comparatively more critical 
for an actuator having a long activation time than for an 
actuator having a short activation time. 

There are two different groups of risk potentials: 

1. universally valid risk potentials independent of 
actuators 

2. special risk potentials depending on actuators. 



5.1.1 Description of the Risk Potentials 

The risk potential is a dimensionless quantity ranging between 
0 and 100. It describes the danger of a defined situation. In 
this respect, a risk potential of 0 means no risk, and a risk 
potential of 100 implies a very high risk. A risk potential of 
100 does not imply that an accident will automatically happen. 
At what time the risk potential will reach the values 0 or 
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100, respectively, is not defined in a universally valid 
manner and, therefore, is definable individually for the 
respective case of application. Depending on the risk 
potentials defined in the control system, the actuators (e.g. 
brake, rev. seat-belt tensioning devices, seat adjustment, 
etc.) are driven. 

As this occurs, individual risk potentials are combined and 
used to drive an actuator. 

The activation and the degree of this activation is combined 
and used to drive an actuator. 

The activation and the degree of this activation are 
safeguarded by an inquiry about threshold values of the risk 
potential or the risk potentials, respectively. 

5.1.2 universally valid risk potentials irrespective of 
actuators 

5.1.2.1.1 longitudinal-dynamics risk potential, depending on 
ambience sensor information out of the ambience 
sensor system 12 (dp_xdyn_sen) 

The assessment of the longitudinal-dynamics driving situation 
is realized by way of a longitudinal-dynamics risk potential 
on condition that the speed is higher than a minimum speed. 
This is achieved by using a Fuzzy interference system. Fuzzy 
logic permits rendering human behavior patterns or hioman 
causal knowledge mathematical and, hence, making it capable of 
being imitated by computers. Subsequently, the traffic 
situation and the driving condition are classified by means of 
membership functions. Thus, the difference between nominal and 
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actual distance is evaluated as an input quantity related to 
the nominal distance sx__rel_des. 

sx_rei_des - sx_ rel ^ ^ 

sx_ rel _des 

The nominal distance depends functionally on the own driving 
speed vx and is determined according to the relation 

sx rel des = sx_rel___desmin + t_ttc_des * vx (5.2) 

nominal distance 
minimum nominal distance 
time until accident 

driving speed in the longitudinal direction. 

The relative speed as a second input quantity is likewise 
categorized by corresponding membership functions. The output 
quantity - that means the longitudinal-dynamics risk potential 
- is also categorized by means of membership functions 
(suitably Singletons (Figure 4) are used) . 

Figure 3 shows the membership functions for the first input 
quantity, that means for the difference between nominal and 
actual distance sx_rel related to the nominal distance 
sx rel^des. This input quantity is classified by means of six 
membership functions. 

The so assessed input quantities are evaluated by means of 
simply definable logical operations, 



with 

sx_rel_des = 

sx_rel_desmin = 

t_ttc_des = 

vx = 



^if then../ 
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relations (rules) and then result in a share in the total risk 
potential for each individual rule, depending on the degree of 
accomplishment. The resulting risk potential shows from the 
accumulation of the individual partial implications. 

Figure 5 shows as an example the control basis which 
originates based on the evaluation of the Fuzzy system. The 
longitudinal-dynamics risk potential is plotted as a function 
of the input quantities 'relative speed' and the difference 
between nominal and actual distance related to the nominal 
distance . 

5.1.2.2 longitudinal-dynamics risk potential, depending on 
ambience sensor information (dp_xdyn_sen_l) 

The longitudinal-dynamics driving situation is assessed by way 
of another longitudinal-dynamics risk potential. This risk 
potential is calculated as follows: 

1. condition: The vehicle speed must exceed a threshold value 
(no risk potential is calculated during maneuvering.) 

2. condition: The relative speed with respect to the detected 
object must be lower than a negative threshold. 

This risk potential sets the deceleration which is necessary 
to prevent a collision in relation to a component of the 
deceleration that is maximally transmittable onto the road. 
The rule of calculation reads: 
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dp xdyn sen I = min 



100 



a. 



*100 



(5.3) 



with e.g. or = 0.4 



5.1.2.3 longitudinal-dynamics risk potential, depending on 
driving dynamics information of the ABS function (dp_xdyn_abs) 

This risk potential is 0 as long as no ABS braking operation 
takes place. If, however, an ABS braking operation is 
performed, this risk potential is 100. 

dp xdyn_abs= 100 for ABS braking active, 

~ 0 for ABS braking inactive (5.4) 



5.1.2.4 longitudinal-dynamics risk potential, depending on 
driving dynamics information of the brake assist function 
(dp_xdyn_hba) 

This risk potential is 0 as long as no braking supported by 
brake assist (classical hydraulic brake assist HBA, not the 
extended brake assist BA+) takes places. If, however, braking 
is carried out with the support of the brake assist, this risk 
potential is 100. 

dp xdyn_hba= lOO for braking with HBA assist (5.5) 
~ ~ 0 for braking without HBA assist or no braking 
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5.1.2.5 lateral-dynamics risk potential, depending on driving 
dynamics information of the ESP function (dp_ydyn_esp) 

This risk potential is 0 as long as no ESP intervention takes 
place. If, however, the ESP intervenes into driving dynamics, 
this risk potential is 100. 

dp_xdyn_esp = 100 for ESP interventions active 

~ 0 for ESP interventions inactive (5.6) 

This definition is only a first embodiment. A finer grading of 
this risk potential is achieved if the information about the 
additional torque m_add_esp in relation to a maximum at 

defined coef f icient-of-f riction conditions is used rather than 
the ESP on/off flag, which maximum must be generated to 
stabilize the vehicle again. 



5.1.2.5 actuator-dependent, special risk potentials 
special risk potential for the actuation of the reversible 
seat-belt tensioning device, depending on the ambience sensor 
information (dp_msb_sen) 

This risk potential is calculated as follows: 

1. condition: The vehicle speed must exceed a threshold (no 
risk potential is calculated during maneuvering) 

2. condition: The relative speed with respect to the detected 
object. must be negative. 

The actual calculation of the risk potential forms the 
quotient of currently determined time to collision ttc from 
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the sensor information and the average activation time of the 
reversible seat-belt tensioning device. 

This quotient indicates how much time still remains to fully 
activate the actuator on an average. The rule of calculation 
is as follows: 





f 










msb _ sen = 100 * min 


l,max^ 
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2 
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^ nvA activate J 
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(5.7) 



As an extension of this relation, it may be arranged for that 
the above calculated risk potential is limited to a defined 
value depending on the quotient of the necessary deceleration 
and the maximum deceleration that can be transmitted to the 
road. This assesses the possibility of the driver to brake 
before the accident happens, meaning, to modify the state 
variables speed and acceleration. These constant state 
variables are the prerequisite in the calculation of the time 
to collision, as used in the way described above. 

Further, it may be arranged for to realize the risk potential 
depending on the quotient of time by a defined lateral offset 
and to limit the time to collision to a defined value. This 
assesses the possibility of the driver to avoid the obstacle. 
The supplement by the above-described extensions leads to a 
more realistic assessment of the actual risk because the 
possibilities of influencing the current driving situation of 
the driver are taken into account. 

Figure 8 shows herein the stepwise activation of a seat-belt 
tensioning device depending on the risk potential, e.g. 20%, 
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60% and 100%. Stage I of the seat-belt tensioning device is 
activated at 20% of the risk potential, stage II is activated 
at 60 %, and stage III at 100 %. At stage I the belt slack is 
removed, at stage II the seat-belt tensioning device is 
preloaded and locked, at stage III the occupant is positioned, 
that means the seat-belt tensioning device is tensioned at 
maximum force and locked. 

The activated seat-belt tensioning device remains in its 
activated stage until the risk potential is below a threshold 
which no longer represents a risk and the resultant vehicle 
acceleration is below a threshold and a defined period of time 
has lapsed. 

5.1.2.6 Special risk potential for the actuation of the seat 
adjustment, depending on the ambience sensor information 
(dp_seat_sen) 

This risk potential is calculated according to the same 
calculation regulation as the risk potential dp_msb_sen. For 
the activation time of the actuator, only the average 
activation time is put up now (instead of tmsb_activate, put 
up tseat_activate) , which is necessary for readjusting the 
seat. The supplements, as described in the calculation of the 
risk potential dp_msb_sen, are applicable also in this case. 

5. 1.2.7 Special risk potential for the actuation of the window 
and/or sliding roof adjustment, depending on ambience sensor 
information (dp_wind_sen/dp_roof_sen) 
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This risk potential is calculated according to the same 
calculation regulation as the risk potential dp_nisb_sen. For 
the activation time of the actuator, only the average 
activation time is put up now (instead of tmsb_activate, put 
up twind_activate or troof_activate, respectively), which is 
necessary to close the window or the sliding roof, 
respectively. The supplements, as described in the calculation 
of the risk potential dp_msb_sen, are applicable also in this 



case. 



The advantage of the invention involves that limiting 
quantities can be calculated, assessed and categorized 
independently of one another. By means of the different risk 
potentials, the general view of the current risk situation can 
be described by simple individual connections. The general 
view of the current risk situation can be seen in the 
evaluation of the single risk potentials. 

The reliability of the data used for determining the above- 
mentioned controlling interventions and the complexity of the 
situation do not allow completely autonomous interventions in 
driving-dynamics-related interventions in the vehicle. 
Therefore, the controlling interventions determined by way of 
the risk calculator can be realized to a respectively suitable 
degree only after an assessment in the arbitration unit 28 
(Figure 2) with the driver's request determined in the driver 
request module 29 (Figure 2), such as the driver action and 
other quantities describing the current driver situation. 

To this end, a state machine utilizes the characteristic 
quantities supplied by the driver request module and, 
depending on these quantities, releases e.g. deceleration 
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specifications of the risk calculator 10. Substantially the 
foot movement of the driver is evaluated. This movement allows 
conclusions about how dangerous the driver estimates the same 
situation to be or whether he has detected a critical 
situation at all. Only if the driver confirms this critical 
situation will brake pressure develop irrespective of the 
driver. As Figure 6 shows, a distinction is made between four 
stages : 

1. not supported: The driver indicates his desire to 
accelerate by a positive time gradient on the acceleration 
pedal (s_aped = accelerator pedal travel) . Even if the risk 
calculator detects a critical situation, brake pressure is not 
built up autonomously in this state pmax = 0 bar. 

2. prefill: This level defines a state where the deceleration 
request of the driver can only be determined to a limited 
extent or does not yet exist. The driver must touch the 
accelerator pedal shaped in this state. There are two 
subordinated states: 

a) prefill 1: The calculated risk potential has a time 
gradient which lies above the defined threshold. The driver 
does not change his accelerator pedal position shaped. This 
situation is interpreted as an extreme aggravation of the risk 
situation so that a brake pressure of a maximum of plmax = kl 
bar is admitted even without active confirmation by the 
driver. This causes application of the brake pads. 

b) prefill 2: When the driver confirms the critical situation 
by leaving the accelerator pedal (negative time gradient on 
the accelerator pedal), a maximum brake pressure of p2max > 
Plmax is allowed. 
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The transitions from prefill 1 to prefill 2 are illustrated in 
detail in Figure 7. 

3. prebrake: The driver has neither operated the accelerator 
pedal nor the brake pedal in this state. Therefore, this state 
0 is interpreted as a limited deceleration request. The 
maximum deceleration is thus raised to approximately the ACC 
level (0,3g) so that a maximum brake pressure of p3max > p2max 
can develop. 

4. extended brake assist: With the transition to this state, 
the driver confirms his deceleration request by applying the 
brake pedal (threshold: brake light switch BLS) . When further 
conditions are fulfilled now, the brake pressure predetermined 
by the risk calculator is released depending on the degree of 
fulfillment . 

These conditions are classified as follows: 

An emergency situation is derived from 

a) the time variation of the brake pressure and the 
stop light information and 

b) the time variation of the risk potentials. 

When this emergency situation is detected, the brake pressure 
calculated by the risk calculator is conducted entirely as a 
nominal value to the brake system. The driver receives maximum 
support. If, however, no emergency situation is detected, a 
characteristic factor is determined representative of the 
extent of the driver's braking request. This factor is 
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composed of three components being considered in a defined 
weighting ratio- 

a) Ratio between the brake pedal travel and the maximum of 
the brake pedal travel, which depends on the pressure in 
the system (represented by the wheel brake pressure) . 
This is necessary because the driver senses the brake 
pressure in the system, should the system be prefilled. 

b) Ratio between the brake pedal speed and the maximum of 
the brake pedal speed. This maximum value is independent 
of the degree of the system's prefilling in 

app r o x ima t i on . 

c) Factor which assesses the time of repositioning the foot 
between the accelerator pedal and the brake pedal. 

The driver is given in this state a brake assist adapted to 
the situation by way of releasing the brake pressure that is 
determined in the risk calculator. 

As Figure 6 shows, the deceleration assist of the driver 
depends on the accelerator pedal travel s_aped and the brake 
pedal travel s_bped. In the direction of the arrow of the 
respective axes shaped and s_bped, an increase of the positive 
or negative acceleration of the vehicle is assumed- When the 
driver adopts the state prefill/not supported 60, the 
arbitration unit is unable to release brake pressure, to 
release a brake pressure which causes application of the brake 
pads, or a brake pressure which causes low deceleration of the 
vehicle. When the driver leaves the accelerator pedal and 
values fall below the threshold THR_S_APED1, he shows the 
desire to decelerate the vehicle, and the state changes via 
the path 61 to prebrake 63. When the driver applies the 
accelerator pedal in the state prebrake, the threshold 
THR S APED2 must be overcome in order that the state changes 
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via the path 62 to pref ill/not supported 60. When the system 
adopts the state prebrake 63 and the driver applies the brake 
pedal until a threshold SMINFOEIAPIABLS is exceeded, the state 
prebrake will change via path 64 into the state extended brake 
assist 65. 

Figure 7 represents the transitions between the states not 
supported, pref ill 1, and pref ill 2. ds_aped designates the 
accelerator pedal speed in this respect. In Figure 7, a 
positive gradient of the accelerator pedal is assumed starting 
from 0 in the direction of the arrow, that means the 
accelerator pedal is applied by the driver and the vehicle 
accelerates; starting from 0 in opposition to the direction of 
arrow a negative gradient is assumed, i.e. the driver 
withdraws the accelerator pedal and the vehicle brakes by 
using the engine. When the state not supported 70 is adopted 
and the gradient of the risk potential ddp_xdy_sen exceeds the 
threshold value THR_DDP_XDYN_SEN_ACT, a change is made via 
path 72 into the state pref ill 1 73. When the state not 
supported 70 is adopted and the driver leaves the accelerator 
pedal, values dropping below the threshold THR_DS_APED1L, a 
change is made via path 71 to the state pref ill 2 74. 
Starting from the state pref ill 2 74, a change is made via 
path 75 into the state prefill 1 73 under the condition that 
the gradient of the accelerator pedal travel is higher than 
the threshold THR_DS_APED2L and the risk potential is lower 
than a threshold. Likewise, the state prefill 2 74 is left via 
the path 76 when the gradient of the accelerator pedal travel 
is higher than the threshold THR_DS_APED2R . 
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The state prefill 1 73 can change via the path 71 into the 
state prefill 2 74 when the gradient of the accelerator pedal 
travel is lower than the threshold THR_DS__APED1L . 

The state prefill 1 73 can change via the path 7 6 into the 
state not supported 70 when the gradient of the accelerator 
pedal travel is higher than the threshold THR_DS_APED2R. 

The conditions of transition can be refined when the vehicle 
acceleration is evaluated as an additional input quantity. The 
advantage of this extension resides in a consideration of an 
accelerated driving condition over a long period of time, 
which is not available when the application of the accelerator 
pedal is evaluated. The driver's request can be realized 
better in this way. 

Transitions are thus achieved which are configured with 
minimal jerks in a favorable manner (e.g. Figure 9) . In this 
arrangement, a sigmoid transition function is used to pass the 
current adjustment level over into the new level. As an 
embodiment, a segment of the sine function or its 
approximation can be utilized by way of a progressive 
development. 

The driver maintains the control in every situation and can 
overrule at least the braking interventions by way of 
application of the accelerator pedal. 



